AI-Powered Cyberattacks: Automation as a Threat

Where attackers use AI today

A cyberattack has many single steps, from picking a target to blackmail. Generative AI and classic automation affect several of them:

• Reconnaissance: Language models read company websites, job ads, trade register entries and profiles on job networks. From this, they map out who works where, who is in charge of what and which tools are in use.
• Phishing and social engineering: Attackers can create convincing emails in flawless German at scale. The emails match the tone of a supplier or the managing director and fit each recipient. Spelling mistakes are no longer a reliable giveaway.
• Voice and video fakes: A few seconds of audio are enough to clone a voice. This makes the well-known CEO fraud scheme stronger. In it, "management" calls in an urgent request to transfer money.
• Vulnerability discovery and exploits: AI helps turn public security advisories into working attacks more quickly. It also scans large amounts of code or exposed services for weak spots. As a result, the time between a patch release and the first attacks tends to shrink.
• Malware variants: Attackers have AI rewrite existing malware so that signature-based tools miss it. Or they use AI as a coding helper for their own tools.
• Mass attacks on logins: Automated credential stuffing and password spraying hit VPNs, webmail and cloud portals around the clock. More and more often, they get past simple bot detection.

The biggest effect is that it is now easier to get started. Even unskilled offenders can run attacks of a quality that once took experience and language skills. Germany's Federal Office for Information Security (BSI) also points to the misuse of generative AI for social engineering and harmful code. It does so in its paper "Generative KI-Modelle – Chancen und Risiken für Industrie und Behörden" (Generative AI models: opportunities and risks for industry and authorities).

What this means for mid-sized companies

Mid-sized firms were never too small to be attacked. But tailored attacks were often not worth the effort. AI lowers the cost per target. Now, custom deception pays off against smaller companies too. These areas are most at risk:

• Payment processes: fake invoices with changed bank details, and calls that seem to come from senior management.
• Internet-facing systems: VPN gateways, firewalls, mail servers and web apps. Attackers scan and attack them quickly once a flaw becomes public.
• Identities: accounts without multi-factor authentication, or with methods that are easy to intercept, such as SMS codes.

At the same time, most AI-assisted attacks still use well-known weak spots: missing patches, weak logins and unclear approval steps. If you have these basics under control, you are also well placed against the automated version.

Effective countermeasures

1. Phishing-resistant authentication: Use FIDO2 security keys or passkeys for email, remote access and admin work. They protect you even when a phishing email is perfectly written.
2. Process over gut feeling: Payments and bank detail changes need approval from two people. They also need a call-back to a known number that did not come from the message itself. This works against voice clones and fake emails alike.
3. Patch exposed systems fast: Rank updates for internet-facing systems by how they are actually exploited, for example with the CISA KEV catalogue. For critical flaws, cut your response time to days, not weeks.
4. Know your attack surface: Check regularly which services can be reached from the internet. Attackers do this automatically. So should you.
5. Behaviour-based detection: EDR tools and a security operations centre spot suspicious behavior. This works even for new malware variants without a known signature.
6. Update awareness training: Teach staff that spelling and tone are no longer reliable warning signs. What matters are unusual requests, time pressure and steps that differ from the normal process.
7. Incident planning: Attacks now unfold faster than before. A tested incident response plan helps you react sooner.

Regulatory context

Some entities fall under NIS2 (Directive (EU) 2022/2555). Germany put it into law through the revised BSI Act (BSIG). For these entities, Section 30 BSIG makes several measures mandatory: risk analysis, handling of flaws, training and multi-factor authentication. Major incidents must be reported in stages:

• early warning within 24 hours
• notification within 72 hours
• final report after one month

These duties apply whether or not the attack used AI.

Conclusion

AI changes the speed and polish of cyberattacks more than their nature. The best answer is solid basics: strong logins, fixed approval steps, fast patching and detection based on behavior rather than signatures. SecTepe supports this with awareness training, penetration testing and a managed SOC.

Frequently asked questions

Does AI-based defence help against AI-based attacks?

It can, for example to spot anomalies and to analyze large amounts of logs. But it does not replace basic controls such as multi-factor authentication and patch management.

How can you spot a cloned call from the managing director?

Often, technical means cannot spot it reliably. That is why you should never act on critical instructions based on a call alone. Always confirm them through a second, independent channel.